diff --git a/.github/workflows/chart-values.yaml b/.github/workflows/chart-values.yaml
index 5ba0b09..bf7a93b 100644
--- a/.github/workflows/chart-values.yaml
+++ b/.github/workflows/chart-values.yaml
@@ -3,11 +3,13 @@ name: Validate chart values and schema
 on:
   workflow_call: {}
 
-permissions: read-all
+permissions: {}
 
 jobs:
   validate:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.github/workflows/gitleaks.yaml b/.github/workflows/gitleaks.yaml
index 12443a8..3df74d9 100644
--- a/.github/workflows/gitleaks.yaml
+++ b/.github/workflows/gitleaks.yaml
@@ -3,11 +3,13 @@ name: Gitleaks
 on:
   workflow_call: {}
 
-permissions: read-all
+permissions: {}
 
 jobs:
   gitleaks:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
diff --git a/.github/workflows/go-coverage.yaml b/.github/workflows/go-coverage.yaml
index 95a5335..86e2335 100644
--- a/.github/workflows/go-coverage.yaml
+++ b/.github/workflows/go-coverage.yaml
@@ -11,7 +11,7 @@ on:
       token:
         required: true
 
-permissions: read-all
+permissions: {}
 
 jobs:
   coverage:
diff --git a/.github/workflows/issue-to-customer-board.yaml b/.github/workflows/issue-to-customer-board.yaml
index a19a592..c048172 100644
--- a/.github/workflows/issue-to-customer-board.yaml
+++ b/.github/workflows/issue-to-customer-board.yaml
@@ -19,9 +19,7 @@ on:
       ISSUE_AUTOMATION:
         required: true
 
-permissions:
-  contents: read
-  issues: write
+permissions: {}
 
 env:
   BOARD_URL: https://github.com/orgs/giantswarm/projects/345
diff --git a/.github/workflows/validate-changelog.yaml b/.github/workflows/validate-changelog.yaml
index fcdee63..9af4966 100644
--- a/.github/workflows/validate-changelog.yaml
+++ b/.github/workflows/validate-changelog.yaml
@@ -3,14 +3,15 @@ name: Validate changelog
 on:
   workflow_call: {}
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   validate-changelog:
     name: Validate changelog structure
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: write
     if: contains(github.event.pull_request.head.ref, '#release#')
 
     steps:
diff --git a/.github/workflows/validate-file-names.yaml b/.github/workflows/validate-file-names.yaml
index 5c0d2b2..70c446f 100644
--- a/.github/workflows/validate-file-names.yaml
+++ b/.github/workflows/validate-file-names.yaml
@@ -5,13 +5,14 @@ on:
   workflow_call:
   workflow_dispatch:
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   validate:
     name: Validate file names
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout code
diff --git a/.github/workflows/validate-workflows.yaml b/.github/workflows/validate-workflows.yaml
index 5310b50..e427559 100644
--- a/.github/workflows/validate-workflows.yaml
+++ b/.github/workflows/validate-workflows.yaml
@@ -6,11 +6,13 @@ on:
       - '.github/workflows/*.yaml'
   workflow_dispatch: {}
 
-permissions: read-all
+permissions: {}
 
 jobs:
   validate:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 691dc37..be2c952 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,8 +10,7 @@ Instead this file uses a date-based structure.
 
 ### Changed
 
-- Restrict permissions for GITHUB_TOKEN in "Fix Vulnerabilities" workflow.
-- Restrict permissions for GITHUB_TOKEN in "Create Release PR" workflow.
+- Set restrictive default token permissions for `create-release-pr`, `fix-vulnerabilities`, `chart-values`, `gitleaks`, `go-coverage`, `issue-to-customer-board`, `validate-changelog`, `validate-file-names`, and `validate-workflows` workflows.
 
 ## 2026-01-16